Summary
- Gibraltar confirmed unauthorised access to its cloud environment, including services supporting government email and document storage.
- Microsoft and specialists coordinated by the UK NCSC assisted containment and forensic investigation.
- Further attempts are being blocked, but investigators have not established whether information was accessed or extracted.
Gibraltar’s government has contained a cyber intrusion affecting its cloud-based IT environment, although investigators have yet to establish whether attackers accessed or extracted sensitive information from official email accounts and document repositories.
HM Government of Gibraltar confirmed on 9 November that unauthorised access had occurred within an environment supporting Microsoft Outlook, Teams, SharePoint, and OneDrive.
The incident originated several weeks before its public disclosure. Microsoft alerted the government to a potential data breach, prompting its Information Technology and Logistics Department (ITLD) to investigate the activity, secure affected systems, and introduce protective measures.
The government sought specialist assistance from the UK’s National Cyber Security Centre (NCSC), which coordinated technical support from partner organisations. Experts travelled to Gibraltar on 2 November to work directly with ITLD.
On 6 November, some government services were suspended to enable forensic investigation and further security work, temporarily disrupting public administration.
Officials subsequently reported that containment measures were in place. Although attempts to access cloud accounts continue, the government says those attempts are being blocked and no further successful access has been observed.
Cloud services remain under investigation
The inquiry centres on the government’s cloud environment, which supports routine communications and document storage across public services.
Such systems can contain correspondence with residents, departmental records, operational information, and documents exchanged between public bodies and external organisations.
The information available depends on which accounts or services an intruder reached and the permissions attached to them. An account with access to shared repositories might have a different exposure profile from one restricted to an individual mailbox.
However, Gibraltar’s government has not disclosed the initial intrusion method, the accounts involved, or the privileges available to the attacker. No named actor or particular software vulnerability has been confirmed.
Investigators are establishing whether information was accessed or extracted. Unauthorised access to the cloud environment is confirmed, but the loss of particular personal records remains unestablished.
Principal resident databases are separately maintained
Officials have distinguished the affected cloud environment from the government’s main databases containing residents’ personal records.
Those databases are maintained on local infrastructure within Gibraltar’s government data centre. Their separate location is an important factor in the assessment of the incident’s present scope.
Nevertheless, an email or collaboration service can itself contain personal information, including material supplied by residents or exchanged between officials. The location of principal databases cannot rule out information exposure elsewhere.
The government has said it will contact individuals directly if forensic findings establish that their personal data requires notification.
No confirmed number of affected people or classes of compromised records has been disclosed.
Containment caused temporary disruption
The suspension of services on 6 November reflects the operational trade-off sometimes required to contain an intrusion. Isolating systems can preserve evidence, restrict further activity, and allow administrators to introduce security changes while investigators assess the environment.
These measures can also interrupt legitimate work, particularly where email and document platforms support coordination between public departments.
Public sector resilience therefore depends on procedures for maintaining essential functions when some collaboration services or accounts must be temporarily restricted.
Microsoft’s initial notification, the work by ITLD, and support coordinated by the NCSC illustrate how incident handling may involve a cloud provider, a local government team, and national cybersecurity specialists.
Notification remains contingent on findings
The government has advised residents to be cautious about unexpected messages, calls, and emails purporting to originate from public departments, and has recommended appropriate password and authentication measures.
Those recommendations are precautionary rather than evidence that attackers have obtained contact information or launched a connected phishing campaign.
The government’s official incident disclosure states that forensic work continues despite the reported containment.
The investigation must still resolve how the initial access occurred, the extent and duration of activity, and whether any information was taken. Its present findings establish unauthorised cloud access, specialist containment work, and an absence of further observed successful access following those measures.
